From d69c4f0f022437edabd13f04fcbf85d40df39126 Mon Sep 17 00:00:00 2001
From: A <258483684+la14-1@users.noreply.github.com>
Date: Sat, 21 Feb 2026 13:47:40 -0800
Subject: [PATCH] fix: reject non-2xx responses in Fly.io token validation
 (#1614)

testFlyToken() fallback to /v1/user accepted 404 plain text responses
because hasError() only checks for JSON "error"/"errors" keys. Adding
resp.ok check ensures non-2xx responses are correctly rejected.

Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 cli/package.json   | 2 +-
 cli/src/fly/fly.ts | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/cli/package.json b/cli/package.json
index 8617c450..8d686fb3 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@openrouter/spawn",
-  "version": "0.5.20",
+  "version": "0.5.21",
   "type": "module",
   "bin": {
     "spawn": "cli.js"
diff --git a/cli/src/fly/fly.ts b/cli/src/fly/fly.ts
index 325947fb..4e68be94 100644
--- a/cli/src/fly/fly.ts
+++ b/cli/src/fly/fly.ts
@@ -143,8 +143,10 @@ async function testFlyToken(): Promise<boolean> {
       headers: { Authorization: authHeader },
       signal: AbortSignal.timeout(10_000),
     });
-    const text = await resp.text();
-    if (text && !hasError(text)) return true;
+    if (resp.ok) {
+      const text = await resp.text();
+      if (text && !hasError(text)) return true;
+    }
   } catch {
     // fall through
   }